Deploy & Operate · Lesson 6 of 6
Cloud Costs, IAM Security and Certifications: Use the Cloud Without Getting Burned
The two ways beginners get hurt in the cloud are surprise bills and leaked credentials. Learn the first-day account setup, IAM and least privilege, cost controls, the free-tier traps, and which certification to take first.
Every year, students share the same story online: they followed a tutorial, forgot to delete a server or a GPU instance, and received a bill they could not afford. Others pushed an access key to GitHub and woke up to someone mining cryptocurrency on their account. Both are completely avoidable. Do this lesson before you build anything big.
Day-one account checklist
- Turn on MFA for the root/owner account, then stop using that account for daily work.
- Create a separate admin user (or use the provider's single sign-on) with MFA, for everyday tasks.
- Set a budget alert — for example, email me at ₹500 and again at ₹1,000 of forecast spend.
- Choose one region near you and use it consistently, so nothing is forgotten in another region.
- Never create long-lived access keys unless you truly need them; never put them in code.
IAM: who can do what
Identity and Access Management (IAM) controls every action in a cloud account. The key ideas:
- Users and groups — people.
- Roles — identities that services or people assume temporarily. A VM or function gets a role to read one bucket, with credentials rotated automatically — no keys stored anywhere.
- Policies — documents listing allowed (or denied) actions on specific resources.
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Action": ["s3:GetObject"],
"Resource": "arn:aws:s3:::fest-photos-2026/*"
}]
}This AWS-style policy allows reading files from one bucket — nothing else. That is least privilege: give each person or service only the permissions its job needs. Azure (role-based access control) and Google Cloud (IAM roles) follow the same principle.
If a key leaks: deactivate it immediately, check the account's activity log for anything you did not do, delete unknown resources, and contact the provider's support — they often help with fraudulent charges when you act fast.
Other security basics
- Keep storage buckets and databases private; use the provider's "block public access" settings.
- Encrypt data at rest (usually one checkbox or on by default) and use HTTPS in transit.
- Store secrets in a secret manager, not in environment files committed to Git.
- Turn on audit logging (CloudTrail, Azure Activity Log, Cloud Audit Logs).
How cloud bills grow — and how to stop them
| Common cause | Fix |
|---|---|
| Forgotten VMs, GPUs or databases left running | Delete after practice; use auto-shutdown schedules; tag everything with an owner and project |
| Oversized instances | Start small, scale up only when metrics show you need it |
| Data transfer out of the cloud | Use a CDN; keep services that talk a lot in the same region |
| Unattached disks, old snapshots, unused static IPs | Review monthly; they keep charging even when nothing uses them |
| Logs and storage that grow forever | Set retention periods and lifecycle rules to move old data to cheaper storage |
Free-tier trap: free tiers have limits on size, hours and services. A "free" VM of the wrong size, a managed NAT gateway or a second running instance can charge from the first hour. Read the free-tier page for the exact service and size, and rely on your budget alert as the safety net.
At company scale, managing cloud spend is a discipline of its own — FinOps — and engineers who think about cost are valued highly.
Which certification first?
| Level | AWS | Azure | Google Cloud |
|---|---|---|---|
| Foundational | Certified Cloud Practitioner | Azure Fundamentals (AZ-900) | Cloud Digital Leader |
| Associate (hands-on) | Solutions Architect – Associate | Azure Administrator (AZ-104) | Associate Cloud Engineer |
A sensible fresher path: one foundational certificate to learn the vocabulary, then two deployed projects, then an associate certificate. Interviewers trust a working project link more than a badge — the badge gets you shortlisted, the project gets you hired.
Remember: MFA on day one, budget alert on day one, least privilege always, and delete what you are not using. Those four habits prevent almost every beginner disaster.
Try it yourself: Create a free-tier account on one provider, then do only the day-one checklist: MFA, a separate admin identity and a budget alert. Take screenshots — "I set up a secure, cost-controlled cloud account" is a genuinely good line for an interview.
Common interview questions
Try answering each one aloud before you open it.
1What is the principle of least privilege?
Granting each user, application or service only the minimum permissions required to perform its task, and nothing more, to limit the damage from mistakes or compromised credentials.
2What is the difference between an IAM user and an IAM role?
A user is a long-term identity for a person or application with its own credentials. A role is an identity that is assumed temporarily and provides short-lived credentials, commonly used by services and for cross-account access, avoiding stored keys.
3How would you control cloud costs?
Set budgets and alerts, right-size and auto-scale resources, shut down or schedule non-production resources, use reserved or spot pricing where suitable, tag resources for accountability, apply storage lifecycle policies and review spend regularly.
Practise this
Build something with it
FAQs
Can I really get a bill from a free-tier account?
Yes, if you exceed limits or use services outside the free tier. A budget alert and deleting resources after practice keep you safe.
How long does the foundational certification take to prepare?
With the official free training and some hands-on practice, many students prepare in two to four weeks of regular study.
References & further reading
Finished this lesson?
Mark it complete. Create a free account to save it on every device.